Security Exceptions API

Import an exception list

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/_import</span></div>

Refer to Spaces for more information.

Import an exception list and its associated items from an NDJSON file.

post/api/exception_lists/_import

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/exception_lists/_import
  • Auth
    • API key in header Authorization
    • or HTTP basic

Query parameters

overwriteboolean

Determines whether existing exception lists with the same list_id are overwritten. If any exception items have the same item_id, those are also overwritten.

as_new_listboolean

Determines whether the list being imported will have a new list_id generated. Additional item_id's are generated for each exception item. Both the exception list and its items are overwritten.

Request body multipart/form-data

filestring binary

A .ndjson file containing the exception list

Example request

{
  "file": "{\"_version\":\"WzExNDU5LDFd\",\"created_at\":\"2025-01-09T16:18:17.757Z\",\"created_by\":\"elastic\",\"description\":\"This is a sample detection type exception\",\"id\":\"c86c2da0-2ab6-4343-b81c-216ef27e8d75\",\"immutable\":false,\"list_id\":\"simple_list\",\"name\":\"Sample Detection Exception List\",\"namespace_type\":\"single\",\"os_types\":[],\"tags\":[\"user added string for a tag\",\"malware\"],\"tie_breaker_id\":\"cf4a7b92-732d-47f0-a0d5-49a35a1736bf\",\"type\":\"detection\",\"updated_at\":\"2025-01-09T16:18:17.757Z\",\"updated_by\":\"elastic\",\"version\":1}\n{\"_version\":\"WzExNDYxLDFd\",\"comments\":[],\"created_at\":\"2025-01-09T16:18:42.308Z\",\"created_by\":\"elastic\",\"description\":\"This is a sample endpoint type exception\",\"entries\":[{\"type\":\"exists\",\"field\":\"actingProcess.file.signer\",\"operator\":\"excluded\"},{\"type\":\"match_any\",\"field\":\"host.name\",\"value\":[\"some host\",\"another host\"],\"operator\":\"included\"}],\"id\":\"f37597ce-eaa7-4b64-9100-4301118f6806\",\"item_id\":\"simple_list_item\",\"list_id\":\"simple_list\",\"name\":\"Sample Endpoint Exception List\",\"namespace_type\":\"single\",\"os_types\":[\"linux\"],\"tags\":[\"user added string for a tag\",\"malware\"],\"tie_breaker_id\":\"4ca3ef3e-9721-42c0-8107-cf47e094d40f\",\"type\":\"simple\",\"updated_at\":\"2025-01-09T16:18:42.308Z\",\"updated_by\":\"elastic\"}\n"
}

Response

Successful response

successboolean required
success_countinteger required
success_count_exception_list_itemsinteger required
success_count_exception_listsinteger required
success_exception_list_itemsboolean required
success_exception_listsboolean required

Example response

{
  "errors": [
    {
      "id": "9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85",
      "item_id": "simple_list_item",
      "list_id": "simple_list"
    }
  ]
}

Changes

No operation changes recorded.